RBAC overview - Stytch Docs

Role-Based Access Control (RBAC) lets you define fine-grained permissions for members based on their roles. An RBAC policy is composed of roles, resources, and actions, defining who can do what within your application.

Using RBAC

Get your RBAC policy

Fetch your current RBAC policy using the Get Policy endpoint:

curl --request GET \
  --url https://test.stytch.com/v1/b2b/rbac/policy \
  --user 'PROJECT_ID:SECRET'

Response:

{
  "status_code": 200,
  "policy": {
    "roles": [
      {
        "role_id": "stytch_admin",
        "description": "Full access to all organization resources",
        "permissions": [
          {
            "resource_id": "documents",
            "actions": ["read", "write", "delete"]
          }
        ]
      }
    ],
    "resources": [
      {
        "resource_id": "documents",
        "description": "Organization documents",
        "actions": ["read", "write", "delete"]
      }
    ]
  }
}

See Create RBAC Policy to set up your policy in the Dashboard.

Assign roles to members

Assign roles when creating or updating members:

curl --request PUT \
  --url https://test.stytch.com/v1/b2b/organizations/organization-test-.../members/member-test-... \
  --header 'Content-Type: application/json' \
  --user 'PROJECT_ID:SECRET' \
  --data '{
    "roles": ["stytch_admin", "editor"]
  }'

Members can have multiple roles, and their permissions are the union of all role permissions.

Check permissions

Enforce permissions by passing the member’s session token to API endpoints:

curl --request DELETE \
  --url https://test.stytch.com/v1/b2b/organizations/organization-test-.../members/member-test-... \
  --header 'X-Stytch-Member-Session: <session_token>' \
  --user 'PROJECT_ID:SECRET'

Stytch automatically verifies the member has the required permissions before processing the request. If unauthorized, the request returns a 403 error.For custom resources, use Authenticate Session with the authorization_check parameter:

curl --request POST \
  --url https://test.stytch.com/v1/b2b/sessions/authenticate \
  --header 'Content-Type: application/json' \
  --user 'PROJECT_ID:SECRET' \
  --data '{
    "session_token": "<session_token>",
    "authorization_check": {
      "organization_id": "organization-test-...",
      "resource_id": "documents",
      "action": "write"
    }
  }'

RBAC policy structure

An RBAC policy consists of three components:

Roles - Named collections of permissions (e.g., admin, editor, viewer)
Resources - Objects members can access (e.g., documents, settings, reports). Stytch provides default resources like stytch.organization and stytch.member.
Actions - Operations members can perform on resources (e.g., read, write, delete)